DRAFT — legal review pending

Privacy notice for Candidates

Version 2026-09 · Effective 1 September 2026

This notice explains how Nordly processes your personal data when you register and apply for Jobs. For each Job you apply to, the Employer is the data controller of your Application and shows you its own notice with its Retention Period before you apply. Nordly is the data controller for your account and for the data described below.

Who we are

Nordly ApS (in formation), Copenhagen, Denmark. Contact: privacy@ — the production address is published here once the domain is live.

What we process and why

• Account — email address, display name, language and time zone: to sign you in and run the service (contract, GDPR Art. 6(1)(b)).
• Profile and CV — the text you enter or upload, and the suggestions extracted from a CV that you accept: to let you apply (contract). Nordly never extracts name, birth date, nationality, photo, address or CPR into structured fields, and a CV's header block is removed before any AI processing.
• Work-Permit Need — your self-declared statement, shown to the Employer as a fact, never sent to any AI model.
• Work Style Profile — your own answers, scored by a deterministic, versioned method, shared with an Employer only when you choose to (consent, Art. 6(1)(a)).
• Applications and Decision Log — which Job, which Stage, what a person or an AI-assisted step recorded: so that you and the Employer can see what happened (contract; legitimate interest in accountability, Art. 6(1)(f)).
• Notifications and email — sent through Brevo (EU) when something happens to your Application.

Sign-in security

Sign-in links are single-use and expire after 15 minutes. To limit abuse, a hash of your email address is kept in Redis for 15 minutes and your IP address for 1 hour; our hosting provider's request logs keep your IP address and the request path for 30 days. No IP address is stored in our database.

AI

Some Employers use AI-assisted summaries, interview questions or rankings. You are told on your Application page whenever that happened, a person always takes the decision, and AI never rejects an Application. You may ask the Employer for an explanation and for human review. Text sent to the AI model (never your name, CPR or contact details — those are removed first) may sit in Google's prompt cache for its abuse-monitoring period, or not at all where zero-data-retention is enabled for our project.

How long

Your account stays until you delete it. A rejected or expired Application is deleted automatically after the Employer's Retention Period (6 months by default, at most 36). An Application left undecided when a Job closes is expired and deleted after the same period. Talent Pool entries last until the expiry date you consented to. Notifications are deleted after 90 days.

Where

All data is stored in the EU (Google Cloud, europe-west1). Sub-processors: Google Cloud EMEA Limited (hosting, database, files, AI models) and Brevo (email).

Your rights

Access, rectification, erasure, restriction, portability and objection (GDPR Art. 15–21) — most of them directly under *My settings*, including a full export and account deletion. You may complain to Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark.